Firewall (PF)

Structured PF rules, validated with pfctl -nf before any apply.

{{#DRIFT_BADGE}}{{#B_UNSAVED}}Unsaved edits{{/B_UNSAVED}}{{#B_DRIFT}}{{B_LABEL}}{{/B_DRIFT}}{{#B_ERROR}}Drift state unknown{{/B_ERROR}}{{#B_OK}}In sync{{/B_OK}}{{/DRIFT_BADGE}}

Existing firewall detected

An existing /etc/pf.conf ruleset is present that OgmaProtect does not yet manage. Until you import it, the firewall shown here is empty and drift alarms may fire. Importing brings your existing rules under OgmaProtect management (your current /etc/pf.conf is saved to /var/db/ogmaprotect/config/pf.conf.preadopt first) and applies them with the usual auto-revert window so you can review and Keep or Revert.

A ruleset that uses anchors, includes or ! commands cannot be imported automatically — you will get a message to migrate it by hand (see the INSTALL guide).

Confirm firewall change

A live PF change by {{PENDING_ACTOR}} is awaiting confirmation and reverts automatically in {{PENDING_REMAINING}} seconds unless you keep it.

If this page stops loading after an apply, do nothing — the firewall reverts by itself at the deadline.

Automatic revert failed — manual recovery required. From the console: ogmaprotectctl pf cancel {{PENDING_TXN_ID}}

Configured {{ENABLED_LABEL}} Live PF {{LIVE_ENABLED_LABEL}} At boot {{RC_ENABLED_LABEL}}

Enabling PF live arms a confirmation window: unless you confirm over this page within the window, the change reverts automatically — no console needed. Rules that block management access can still lock out this session until the revert fires.

Raw pf.conf rules in use

This firewall was configured with raw pf.conf text, which the visual editor cannot represent. The current rules are shown read-only in the Preview tab below. The raw editor has been removed — to manage this firewall here, convert it to the visual editor. Converting discards the raw rules; the live firewall keeps running unchanged until you build and apply a new ruleset.

This ruleset would drop your management access. The firewall refused it because the declared management path (SSH/HTTPS to this box) is not preserved. Fix the rules or your management declaration on the Safety tab — or, if you have out-of-band recovery, tick the box below to apply it anyway. {{#WRITE}} I understand — apply even though it may lock out management {{/WRITE}}

Click a rule to edit its fields. Rules are evaluated top-to-bottom and the last match wins unless you set quick.

Top-of-ruleset set options applied before any filter rule. Leave a value as default (or blank) to use PF's built-in default.

Reusable names. ext_if = "vio0" lets you write on $ext_if in rules. Tag each macro with a type so the rule builder can suggest it in the right field, and add several values to build a { list } such as web_ports = "{ 80, 443 }".

Named address lists referenced as <name> in rules. Pick a source — a manual list (prefix an address with ! to exclude it), a network interface's live addresses, or self. persist keeps the table loaded even when no rule references it; const makes it read-only; counters tracks per-address traffic.

Egress traffic shaping (QoS). Define an HFSC queue hierarchy: a root queue carries an interface and a total bandwidth; child queues name a parent and share it. Each root interface needs exactly one default leaf. Add optional flows for fq-codel fair-queueing on a leaf. Attach traffic with Set queue on a rule (Rules tab). Queues shape egress only and can never drop a packet.

Editing is locked while a change by {{PENDING_ACTOR}} awaits confirmation (deadline above).

The visual editor is read-only until you convert this firewall (above).

Live state table requires JavaScript.

			NAT	Dir					Expiry			Actions

Table contents:

Live entries of this PF table (pfctl -t <name> -T show -v). Removing an entry unblocks that address. Counters appear only for counters tables.

Address	Cleared	Packets (in/out)	Bytes (in/out)	Actions

Live packet log (pflog)

Rule # Open to stream pflog packets.

Time	Action	Iface	Rule	Packet

Decoded from the binary /var/log/pflog via tcpdump -r. Enter a rule number to watch hits for one rule. This shows only packets matched by rules that carry the log keyword, and may be empty on a stock configuration. Requires pf:*:read + log:*:read.